Prelude User Manual General Configuration
Total Page:16
File Type:pdf, Size:1020Kb
Prelude User Manual [[PreludeForeword|Foreword]] 1. Introduction 1. [[PreludeGlossary|Glossary]] 2. [[PreludeComponents|Prelude Components]] 3. [[PreludeArchitecture|Prelude Architecture]] 4. [[PreludeStandards|Prelude Standards]] 5. [[PreludeCompatibility|Prelude Compatibility]] 2. Installation 1. [[InstallingPreludeRequirement|Installation Requirements]] 2. [[InstallingPrelude|Installation from sources]] 1. [[InstallingPreludeLibrary|Libprelude]] 2. [[InstallingPreludeDbLibrary|LibpreludeDB]] 3. [[InstallingPreludeManager|Prelude Manager]] 4. [[InstallingPreludeCorrelator|Prelude Correlator]] 5. [[InstallingPreludeLml|Prelude LML]] 6. [[InstallingPreludePrewikka|Prewikka]] 3. [[InstallingPackage|Installation from packages]] 4. [[AgentsInstallation|Agents Installation]] 1. [[InstallingAgentRegistration|Agents Registration]] 2. [[InstallingAgentThirdparty|3rd Party Agents Installation]] 3. Configuration 1. [[ConfigurationGeneral|General Configuration]] 2. [[PreludeComponentsConfiguration|Prelude Components Configuration]] 1. [[PreludeManager|Prelude-Manager]] 2. [[PreludeCorrelator|Prelude-Correlator]] 3. [[PreludeLml|Prelude-LML]] 4. [[PreludeImport|Prelude-Import]] 3. [[HowtoHACentralServices|Howto Configure High Availability Central Services]] 4. Optimisation 1. [[DatabaseOptimisation|Database Optimisation]] 5. User Manuals 1. [[ManualPrewikka|Prewikka Manual]] 2. [[ManualPreludeAdmin|Prelude-Admin Manual]] 3. [[ManualPreludeDbAdmin|PreludeDB-Admin Manual]] 6. Development 1. [[DevelopmentGuidelines|Development guidelines]] 2. [[SourceOrganization|Source organization]] 3. [[PrewikkaApps|Prewikka Apps]] 4. [[DevelAgentQuickly|Prelude Agent]] 5. [[PreludeAgentContribution|Prelude Agent Contribution program]] 6. [[libpreludeAPI|Libprelude API]] 7. [[libpreludedbAPI|Libpreludedb API]] 8. [[ContinuousIntegration|Prelude CI]] General Configuration All Prelude agents have a common set of options, provided through the Prelude framework. You might modify these options system wide or in the Prelude specific configuration file a client might provide. All options defined system wide might be overriden in the client own Prelude configuration file. These are just template values that the client will use in case the values are not defined in the client own Prelude configuration file. Once the Prelude library is installed, you can tune system wide options using the following configuration files (replace $PREFIX with your installation prefix, usually /usr or /usr/local): $PREFIX/etc/prelude/default/client.conf $PREFIX/etc/prelude/default/global.conf $PREFIX/etc/prelude/default/idmef-client.conf $PREFIX/etc/prelude/default/global.conf 08/02/2016 1/61 This is the common configuration file used by all Prelude programs (sensors, prelude-manager). It provides a system wide template for common IDMEF attributes used by sensors. All of theses settings are optional, but keep in mind setting them will help you to keep track of where an event is coming from, especially in a distributed environment with a high number of sensors. The heartbeat-interval option defines how often a Prelude client should send a heartbeat (the default is 600 seconds). You can define IDMEF attributes to be carried by events emitted by the programs using the framework. All of these settings are optional, but keep in mind setting them will help you to keep track of where an event is coming from, especially in a distributed environment with a high number of sensors. - analyzer-name: Name for the analyzer (By default, this is set to the profile name used by the sensor). - node-name: Name of the equipment (usually the name of the machine this sensor is running on). - node-location: Location of the equipment (could be a city, or a country). - node-category: The type of node the clients are runing on (usually hosts). You might also want to define one or several node-address section, containing the following options: - address: The address of the equipment. - netmask: Netmask for this address. - vlan-name: Name of the Virtual Lan to which the address resides in. - vlan-num: Number of the Virtual Lan to which the address resides in. - category: Type of address represented (usually ipv4-addr or ipv6-addr). $PREFIX/etc/prelude/default/client.conf In this configuration file, you can configure the connection string that clients, which need to connect to a Prelude Manager, will use. You can use boolean '\|\|' (OR) and '&&' (AND) to set up a redundant configuration environment. Note that whatever you specify here, any events sent through the Prelude framework are saved in case the remote Manager goes down. In this case, all events will be saved and the client will periodically attempt to reconnect and flush saved events. Here are a few configuration examples: server-addr = x.x.x.x Connect and send events to x.x.x.x. server-addr = x.x.x.x && y.y.y.y Connect and send events to both x.x.x.x and y.y.y.y. server-addr = x.x.x.x || y.y.y.y Connect and send events to x.x.x.x, or fallback to y.y.y.y if x.x.x.x failed. $PREFIX/etc/prelude/default/idmef-client.conf This file includes both $PREFIX/etc/prelude/default/global.conf and $PREFIX/etc/prelude/default/client.conf. It is often used as the template by clients that need to connect to a prelude-manager. You probably should not modify this file directly (use global.conf and client.conf). Howto Configure High Availability Prelude Central Services This is an example configuration utilizing two machines to provide a high availability pair for the central Prelude services, which include: [[PreludeManager|Prelude-Manager]] [[PreludeCorrelator|Prelude-Correlator]], [[Prewikka]], and MySQL. 08/02/2016 2/61 Table of Contents Heartbeat will control the failing over of hard failures, such as a machine going down or total loss of connectivity. Both servers will maintain an up-to-date set of databases, and either can take over at a moments notice as the primary. You will need to use some form of monitoring, such as Nagios to handle service failures - thus alerting you when a manual failover is required (such as if a particular service dies, but the hardware remains operational and reachable). Things that are assumed: - You will need at least two ethernet interfaces per server (and two servers). - Assumes you have eth0 configured with IP/hostnames on both boxes. This example uses preludecentral_1 and preludecentral_2, and a VIP (virtual IP) with associated hostname, such as preludecentral. Make sure you also add the VIP/hostname to DNS/host/etc., as this is what you expose to your clients/relays/agents/etc. - This document assumes high availability for fault tolerance, not for performance. Although you could stagger which services are offered where, etc. MySQL Multi-Master Replication Configuration You must have installed MySQL v5.x or above. Some features to avoid collisions in multi-master replication are only available in MySQL v5.x 1. Setup secondary ethernet interfaces - Setup eth1 on each server to be an unused private network for use by your HA pair. - Connect with a crossover cable between them. 2. Make the following additions on both servers in /etc/my.cnf, under [mysqld] section: wait_timeout=259200 interactive_timeout=259200 max_connections=200 log-bin=<$HOSTNAME>-mysql-bin #change hostname to be each machines hostname server-id={1,2} #set one server for 1 and the other for 2 auto_increment_increment=2 auto_increment_offset={1,2} #set one server for 1 and the other for 2 # Timeouts and max connections have been increased to handle a client disconnect issue. # Various other settings can be adjusted to the specs of your machine, such as buffer sizes, log sizes, etc. 3. Change datadir in /etc/my.cnf to be on a partition of its own of acceptable size, edit /etc/fstab, and add "async,noatime" as options for the partition used for the MySQL database directory. 4. Run mysql on each server: - Enter at prompt: GRANT REPLICATION SLAVE on *.* TO some_replication_user IDENTIFIED by 'putreplicationpasswordhere'; 5. Add to the end of the mysql binary line in the start section of /etc/init.d/mysqld - --relay-log=<$HOSTNAME>-relay-bin #make sure to specify the correct hostname 6. From each server's mysql command-line: show master status; 7. From each server's mysql command-line: change master to master_host='<other hosts eth1 private ip address>', master_user='<username setup earlier for replication>', master_password='<password used earlier for replication>', master_log_file='<output of 1st column from above step on other server', master_log_pos=<output of 2nd column from above step on other server>; 8. Restart mysqld on each of the servers 9. Configure a root mysql password from the mysql command-line (only needs to be done on one server): - SET password for root@localhost=password('putmysqlrootpasswordhere'); - FLUSH PRIVILEGES; Prelude Central Components 1. You must install [[InstallingPreludeLibrary|Libprelude]] [[InstallingPreludeDbLibrary|LibpreludeDB]] [[InstallingPreludeManager|Prelude-Manager]] [[InstallingPreludeCorrelator|Prelude-Correlator]] and [[InstallingPreludePrewikka|Prewikka]] on both machines. 2. All of the central Prelude services should have the same configuration files on both servers (ie. prelude-manager, 08/02/2016 3/61 prelude-correlator, apache, etc.) 3. When importing the prelude and prewikka schemas to their respective databases, it only needs to be done on one of the servers, it will be replicated to the other automatically. 4. Copy over profiles (if you have a Prelude Central already setup) or register for all profiles needed: